2013-28479. Credit Union Service Organizations

AGENCY:

National Credit Union Administration (NCUA).

ACTION:

Final rule.

SUMMARY:

NCUA is issuing a final rule to amend its credit union service organization (CUSO) regulation to increase transparency and address certain safety and soundness concerns. The final rule expands the requirements of the CUSO regulation that apply to federally insured, state-chartered credit unions (FISCUs) to address accounting, financial statements, and audits. The final rule also includes limits on the ability of “less than adequately capitalized” FISCUs to recapitalize their CUSOs. In addition, it adds several new requirements that apply to both federal credit unions (FCUs) and FISCUs. Specifically, all CUSOs are required to annually provide basic profile information to NCUA and the appropriate state supervisory authority (SSA). CUSOs engaging in certain complex or high-risk activities are required to additionally report more detailed information, including audited financial statements and general customer information. The final rule also requires all subsidiary CUSOs to follow applicable laws and regulations.

DATES:

This rule is effective June 30, 2014. CUSOs will begin submitting reports to NCUA under new § 712.3(d)(4) when the agency's reporting system is fully operational, which will be by December 31, 2015.

FOR FURTHER INFORMATION CONTACT:

Pamela Yu, Staff Attorney, Office of General Counsel, at 1775 Duke Street, Alexandria, Virginia 22314-3428, telephone [phone], or Lisa Dolin, Program Officer, Office of Examination and Insurance, at 1775 Duke Street, Alexandria, Virginia 22314-3428, telephone [phone].

SUPPLEMENTARY INFORMATION:

 

I. Background

A. Why is NCUA adopting this final rule?

B. What changes were released for comment in the 2011 proposed rule?

II. Summary of Public Comments

A. What were the general comments supporting the proposed rule?

B. What were the general comments opposing the proposed rule?

III. Final Rule

A. What changes does this rule make?

B. How does this rule impact credit unions?

C. What are the key provisions in the final rule?

IV. Draft Reporting Form

V. Regulatory Procedures

I. Background

A. Why is NCUA adopting this final rule?

CUSOs provide significant value to the credit union industry by acting as a collaborative means to share risk, manage costs, and deliver services to credit union members. With their unique collaborative business model, CUSOs foster cooperation and shared innovation for credit unions to achieve economies of scale, retain expertise, and better serve their members. Thus, the NCUA Board (the Board) recognizes that CUSOs benefit both credit unions and credit union members. Nevertheless, the Board believes the ability to accurately inventory CUSOs and evaluate their financial and operational condition is imperative to mitigating risks to the National Credit Union Share Insurance Fund (NCUSIF). The Board is adopting this rule to improve the quality of information about CUSOs and the nature of their activities, in order to identify risks to the credit union industry and protect the NCUSIF.

In 2008, the Board issued a final rule, which, among other things, made certain provisions of the CUSO regulation applicable to FISCUs.^[1] Specifically, the final rule requires FISCUs to maintain separate corporate identities from their CUSOs. It also requires FISCUs to enter into agreements with CUSOs stating that the CUSOs would provide open access to their books and records to NCUA and the applicable SSA.^[2] Those provisions had previously only applied to FCUs, but the Board believed that, to protect the NCUSIF, it was necessary to apply those requirements to FISCUs as well.

Since the promulgation of the 2008 rule, the Board has determined that additional protections in the CUSO rule addressing investments, accounting, financial statements, and audits should similarly be extended to FISCUs in order to protect credit unions and the NCUSIF. Additionally, since 2008, the agency has continued to investigate ways to improve the quality of information about credit unions' use of CUSOs and the services provided by CUSOs. The Board does not believe that the information NCUA currently maintains on CUSOs is sufficient to evaluate CUSOs and their potential impact to the NCUSIF. For example, at this time, NCUA cannot fully determine which CUSOs maintain relationships with which credit unions, the financial condition of CUSOs, the full range of services offered by CUSOs, or even the total number of CUSOs that presently exist. The current information is incomplete, primarily because the agency is collecting information on a CUSO from the CUSO's credit union clients rather than directly from the CUSO itself. Further, directly capturing CUSO information reduces the regulatory burden to FICUs in reporting this information. The Board believes that, in order to identify emergent risks posed by CUSOs and to protect the NCUSIF, it is imperative to have complete and accurate financial and operational information about CUSOs and the nature of their services.

As a result, the Board is issuing this final rule, which makes additional parts of the CUSO rule applicable to all federally insured credit unions (FICUs). The final rule also requires CUSOs to register basic information (and, in some cases, to file more detailed reports) directly with NCUA and the appropriate SSA, if applicable. Additionally, it also codifies existing agency policy regarding subsidiary CUSOs. Finally, the rule makes technical changes to reference federally insured credit unions and define “CUSO,” and conforming amendments to § 741.222 to reflect the changes affecting FISCUs in this final rule.

B. What changes were released for comment in the 2011 proposed rule?

On July 21, 2011, the Board issued a proposed rule to amend part 712 of NCUA's regulations to increase transparency and address certain safety and soundness concerns regarding CUSOs.^[3] The proposed rule applied several existing provisions in the CUSO rule to FISCUs. First, the proposal limited a “less than adequately capitalized” FISCU's aggregate cash outlay to a CUSO, measured on a cumulative basis, to the permissible investment limit in the state in which the FISCU is chartered. These proposed changes are similar to the requirements in § 712.2(d)(2) for FCUs. They were intended to address the Board's concern that less than adequately capitalized FISCUs are continuing to invest money in failing CUSOs, thereby posing serious risks to their members and the NCUSIF. Second, the proposed rule applied existing provisions related to accounting, financial statements, and audits to FISCUs. These particular provisions already apply to FCUs under § 712.3(d).

The proposed rule also added two new requirements to apply to all FICUs. Specifically, the proposed rule required FICUs to include, in their agreements with CUSOs, a requirement that a CUSO submit a financial report directly to NCUA or, in the case of a CUSO invested in by a FISCU, NCUA and the appropriate SSA. Under the proposal, these reports would be required to be submitted at least annually. (Proposed § 712.3(d)(4)). The proposed reporting requirement was intended to protect the NCUSIF by improving the quality of available information about CUSOs so that NCUA could better evaluate and identify emergent risks posed by CUSOs. Additionally, the proposed rule prohibited FICUs from investing in a CUSO unless that CUSO's subsidiaries also comply with all of the requirements of the CUSO rule and/or laws and rules of the state in which the credit union is chartered, as applicable. (Proposed § 712.11).

II. Summary of Public Comments

The public comment period for the proposed rule ended on September 26, 2011. NCUA received 290 comments on the proposed rule: 64 from CUSOs, 54 from FCUs, 85 from state-chartered credit unions, 1 from a corporate credit union, 7 from trade associations (1 representing banks, 2 representing credit unions, 1 representing CUSOs, 1 representing state credit union regulators, 1 representing cooperatives, and 1 assisting credit unions in investments and insurance), 21 from state credit union leagues, 2 from non-profit policy or research organizations, 2 from law firms or attorneys, and 54 from individuals.

Of the 290 comments received, 85 were duplicative in some manner, for example, identical “form” letters from different individual commenters, identical letters from the same person representing different organizations, identical letters from different people representing the same organization, or different letters from the same person representing the same organization. Additionally, the majority of the comments exhibited notable similarities. For example, a significant number of comments contained at least some duplicative or “form” language, presented similar arguments or talking points, cited similar data or statistics, or posed similar questions for clarification.

Most of the commenters expressed opposition to, or raised concerns about, one or more aspects of the proposed rule. A few commenters were supportive of the proposal overall.

A. What were the general comments supporting the proposed rule?

The commenters who supported the proposal were generally in favor of subjecting CUSO activities to greater regulatory scrutiny. Several supporters of the rule, however, argued that the proposal did not go far enough and that additional oversight is necessary in order to protect consumers and to mitigate the potential risk to the NCUSIF.

Additionally, a number of commenters opposed the proposal in general, but expressed support for certain aspects of it. In particular, several commenters supported the proposed recapitalization limits for less than adequately capitalized FISCUs, noting that this particular provision is consistent with safety and soundness. Several commenters also supported applying the same CUSO rules to FISCUs and FCUs. Several opponents of the rule in general also expressed support for greater transparency between CUSOs and credit unions. These commenters suggested, however, that instead of being required to report financial information directly to NCUA, CUSOs should improve and enhance the information shared with participating credit unions.

B. What were the general comments opposing the proposed rule?

Commenters expressing opposition to the rule focused primarily on the proposed financial reporting requirement. Most commenters raised concerns about NCUA's authority to impose the proposed reporting requirement. They noted that NCUA does not have statutory authority to directly regulate CUSOs, and questioned whether NCUA's general safety and soundness and examination authority under the Federal Credit Union Act (FCU Act) is sufficient to justify the increased regulatory oversight of CUSOs. Nearly all commenters indicated they do not believe CUSOs pose a true systemic risk to the NCUSIF and argued that additional regulation by NCUA is unnecessary. Commenters contended that NCUA's current authority over CUSOs is sufficient, noting that problems with CUSOs are few, and that these problem cases can be addressed by improving NCUA's supervisory oversight of credit unions and strengthening due diligence requirements. Most commenters suggested that, if the Board adopts a final rule, the Board should take a more targeted regulatory approach by tailoring the rule to identified problem areas. They argued that the proposal is misguided in treating all CUSOs the same, regardless of the CUSO's line of business.

In addition, a substantial number of commenters argued that the proposed rule would unnecessarily and unfairly increase regulatory burden and compliance costs to both credit unions and their affiliated CUSOs, stifling innovation and placing them at a competitive disadvantage to their non-CUSO competitors. Commenters also expressed concern that certain requirements under the proposal would be a condition of NCUSIF coverage.

NCUA has carefully reviewed and considered all the comment letters it received in response to the proposal. Recognizing the significant concerns raised by commenters, the Board has made substantial adjustments to the final rule. The key provisions of the final rule, along with an analysis of the pertinent public comments, are discussed in greater detail below.

III. Final Rule

A. What changes does this rule make?

Under this final rule, several provisions of the current CUSO regulation which previously applied only to FCUs will now apply to FISCUs as well. The rule also adds a new requirement for all FICUs to require their CUSOs to register basic information (and, in some cases, to file more detailed reports) directly with NCUA and, if applicable, the appropriate SSA. Finally, the final rule clarifies the regulation's applicability to subsidiary CUSOs by codifying existing policy in the regulatory text.

B. How does this rule impact credit unions?

FCUs and FISCUs making loans to and investments in CUSOs are impacted by this final rule. The Board emphasizes, however, that the final rule is significantly more limited in application than the proposed rule, targeted mainly to CUSOs engaged in more complex or high-risk activities, such as credit and lending, information technology (IT), and custody, safekeeping, and investment management services for credit unions.

C. What are the key provisions in the final rule?

A detailed discussion of the final rule's key provisions follows.

Applicability of Certain CUSO Rule Provisions to FISCUs

Section 120 of the FCU Act authorizes the Board to prescribe rules and regulations for the administration of the FCU Act.^[4] Further, Title II of the FCU Act provides that the Board may insure members' accounts and administer the NCUSIF, and may prescribe regulations for FICUs that are necessary to carry out that purpose.^[5] Subpart B of Part 741 addresses NCUA regulations that FISCUs must follow to obtain and maintain federal share insurance from NCUA. Currently, only two provisions of the CUSO rule apply to FISCUs: (1) § 712.4, which addresses corporate separateness, and (2) § 712.3(d)(3), which provides NCUA and the applicable SSA with access to CUSO books and records. The Board believes certain requirements should be consistent among all FICUs to minimize risk to the NCUSIF. The risk to the NCUSIF from CUSO operations is the same, regardless of the charter type of the credit union. However, individual state regulatory requirements for CUSO activities may vary from NCUA's regulations. The FCU Act limits FCU loans to CUSOs to a maximum of 1% of paid-in and unimpaired capital and surplus.^[6] The FCU Act also restricts FCU investments in CUSOs to the same amount.^[7] Under certain state laws, however, FISCUs are permitted to invest or loan to CUSOs in significantly higher amounts. For example, some state limits are as high as 25% or they are unspecified.^[8] Accordingly, for uniformity among all FICUs and to minimize risk to the NCUSIF, this final rule amends § 741.222 to specify that current § 712.2(d)(2), which imposes certain recapitalization restrictions, and § 712.3(d), which addresses CUSO accounting, audits, and financial statements, also apply to FISCUs.

Limits on Recapitalization of Insolvent CUSOs—Applicability of § 712.2(d)(2) to FISCUs

In 2008, the Board amended the CUSO regulation to require less than adequately capitalized FCUs to obtain written approval from the appropriate regional director before making an investment in a CUSO that would result in an aggregate cash outlay, measured on a cumulative basis, in an amount in excess of 1% of the credit union's paid-in and unimpaired capital and surplus.^[9] The Board promulgated the amendment because, as it noted in the 2008 proposed rule, it was aware of credit unions that had experienced losses because they chose to recapitalize insolvent CUSOs.^[10] The 2008 amendment was intended to prevent an FCU from investing, on an aggregate basis, more than 1% of its capital in a CUSO that has essentially become unsustainable.

This final rule adds a similar requirement for FISCUs except where state law specifies a higher investment limit in CUSOs. The provision will apply in circumstances where a FISCU is already less than adequately capitalized or where the recapitalization of a CUSO will render the FISCU less than adequately capitalized for Prompt Corrective Action (PCA) purposes.^[11] Under the rule, if a FISCU is less than adequately capitalized or the investment will result in the FISCU being less than adequately capitalized, the FISCU must obtain written approval from the appropriate SSA before making an investment in a CUSO that will result in an aggregate cash outlay, measured on a cumulative basis, that exceeds the investment limit in the state in which the FISCU is chartered. If the applicable state does not regulate the investment limit for FISCUs, however, the FISCU must obtain regulatory approval from the appropriate SSA before making an investment in a CUSO that will result in an aggregate cash outlay, measured on a cumulative basis, in excess of 1% of the FISCU's paid-in and unimpaired capital and surplus.

In addition to submitting a request to the appropriate SSA, a less than adequately capitalized FISCU, or a FISCU that would be rendered less than adequately capitalized by the recapitalization of a CUSO, must also submit its request to the appropriate NCUA regional office. While the SSA will decide such requests, the Board believes it is important that NCUA's regional offices also be made aware of these requests so NCUA can provide appropriate input to the SSAs. The Board notes that this amendment does not require a less than adequately capitalized FISCU, or a FISCU that would be rendered less than adequately capitalized by the recapitalization of a CUSO, to divest of a CUSO. Rather, it may maintain its existing investment, but it cannot make additional investments in any CUSO without prior written approval from the appropriate SSA.

Several commenters generally supported applying the same CUSO rules to FISCUs and FCUs. A number of commenters also expressed specific support for this provision, noting that imposing investment limits for less than adequately capitalized FISCUs is consistent with safety and soundness. Some commenters, however, disagreed with the cumulative calculation for the aggregate cash outlay or expressed confusion regarding its application. In particular, several commenters asked for clarification regarding how far back in time the cumulative calculation must go. The Board adopts this provision substantially as proposed, but, for clarity, the final rule limits the cumulative calculation to the last 7 years. This time period corresponds with various other accounting time limits, such as the length of time bankruptcies are reported, and record retention timeframes for audit and tax purposes. Parallel amendments are made in the final rule to limit the cumulative calculation to 7 years for both FCUs and FISCUs.

CUSO Accounting, Audits, and Financial Statements—§ 712.3(d)

Under the final rule, provisions in the current CUSO rule addressing CUSO accounting, audits, and financial statements which currently only apply to FCUs also now apply to all FICUs. As discussed above, in 2008, the Board amended § 712.3(d) to require FISCUs to comply with the subsections addressing access to a CUSO's books and records.^[12] This final rule applies all of the subsections of § 712.3(d) to FISCUs. Under these additional subsections, a credit union's agreement with a CUSO must require the CUSO to account for all of its transactions according to Generally Accepted Accounting Principles (GAAP), prepare quarterly financial statements, and obtain an annual audit of its financial statements by a licensed certified public accountant.

As noted above, a number of commenters supported applying the same rules to FISCUs and FCUs. A few commenters, however, expressed concern that the proposal to apply the financial statement and audit provision, § 712.3(d)(2), to FISCUs would result in higher compliance costs to the credit union and CUSO where a CUSO is wholly owned and the CUSO's financials are consolidated into the investing credit union's financial statements. The Board notes that under this final rule, as well as under the existing rule for FCUs, a wholly owned CUSO would not be required to obtain a separate annual financial statement audit if the CUSO is included in the annual consolidated financial statement audit of its investing credit union. As such, the Board does not anticipate that the extension of § 712.3(d)(2) to FISCUs will impose an unreasonable compliance cost where a CUSO is wholly owned. The Board continues to believe it is necessary to extend these requirements to FISCUs to ensure NCUA will be able to fully review the financial condition of CUSOs and evaluate the risks posed to FISCUs and ultimately to the NCUSIF. Accordingly, the section is adopted as proposed.

Reporting Requirement—§ 712.3(d)(4)

The proposed rule added a new provision to require a FICU's agreement with a CUSO to require it to file financial reports with NCUA and, as applicable, the appropriate SSA (proposed § 712.3(d)(4)). The proposal was intended to allow NCUA to collect uniform information directly from all CUSOs, in order for the agency to adequately evaluate the relationships between CUSOs and credit unions, as well as the risk posed by those relationships. As discussed in the preamble to the proposed rule, the Board believes that the information NCUA currently compiles on CUSOs is incomplete because the agency is indirectly gathering pertinent information from customer credit unions rather than directly from the CUSOs. Without additional reporting directly from CUSOs, it is impossible for NCUA to determine which CUSOs maintain relationships with which credit unions, the financial condition of CUSOs, and the full range of services offered by CUSOs. This lack of information restricts NCUA's ability to conduct offsite monitoring and evaluate the risks posed by CUSOs. As proposed, the information required in the reports would have to be submitted at least annually and would address five broad categories: (1) General information; (2) board and management; (3) services; (4) credit union customer listing; and (5) balance sheet and income statement. In addition, the Board proposed to require a newly formed CUSO to file the report within 30 days after its formation.

As discussed above, this requirement was troubling to most commenters. Commenters expressed opposition to the reporting provision and asked the agency to substantially revise or withdraw the proposal. Commenters also expressed concerns about NCUA's authority to impose the proposed requirements. They noted that NCUA does not have statutory authority to directly regulate CUSOs and, as such, the reporting requirement is overreaching. Further, commenters argued that the provision is unjustified, contending there is insufficient data to demonstrate that CUSO investments present a material risk. Moreover, they argued NCUA's current authority over CUSOs is sufficient to stem any potentially serious risk issues.

The Board disagrees. While the Board acknowledges that NCUA does not have direct statutory and regulatory authority over the operations of CUSOs, NCUA does have the authority to regulate FCUs' lending and investment in CUSOs.^[13] NCUA has regulated this lending and investment authority in the CUSO rule since 1979, when this statutory provision was implemented through the promulgation of the first CUSO regulation.^[14] The Board believes the proposed reporting requirement is both historically and legally consistent with NCUA's statutory authority to regulate this lending and investment authority.

Moreover, Title II of the FCU Act provides the Board with the broad authority to insure members' accounts and administer the NCUSIF, and to prescribe regulations for FICUs that are necessary to carry out that purpose.^[15] All FICUs, through their application for insurance, have agreed to comply with those regulations. The current lack of information on CUSOs limits NCUA's ability to conduct offsite monitoring and assess any emergent risks to the NCUSIF posed by CUSO operations. The Board continues to believe that, to protect the NCUSIF from any such risk, it is necessary and within its authority to implement regulations that require credit unions to enter into agreements with CUSOs requiring CUSOs to submit reports directly to NCUA and the appropriate SSAs, if applicable.

Furthermore, the Board continues to believe that CUSOs present material risks to the credit union industry. Past experience has demonstrated that a single CUSO has caused losses and operational problems at multiple credit unions. Such losses have contributed to a number of credit unions' insolvency, conservatorship, or liquidation. The following are specific examples in which CUSO activity caused significant financial and/or operational problems for credit unions.^[16]

Case #1—Activities involving multiple CUSOs contributed to a $1.5 billion FICU's failure. Since 2008, the FICU sustained losses totaling approximately $224 million as a direct result of its CUSO activity.

Case #2—A CUSO managed four loan pools primarily comprised of commercial loans. In addition to having loan participation agreements with 25 FICUs, the CUSO obtained warehouse lines of credit from several banks and one corporate credit union. In 2008, the CUSO's access to third party investors declined with the economic turndown. To stay in compliance with its written agreements with FICUs, the CUSO shifted mortgages from one mortgage pool to another. Investor FICUs were provided monthly reports on the loan pools, but the information was poorly presented. As a result, it was difficult for investor FICUs to determine the individual mortgages transferred among the pools. The CUSO eventually defaulted on its warehouse lines of credit. It was put into bankruptcy in 2009. In total, aggregate losses to the FICUs involved with this CUSO exceeded $47 million. Of the 25 FICUs affected, 10 were assumed by other FICUs. The aggregate cost to the NCUSIF for these actions was over $5 million.

Case #3—Nineteen FICUs incurred losses totaling over $5 million in the last 5 years from a CUSO involved in member business loan participations. An additional $6 million in losses are projected from one commercial borrower. FICUs have already reserved between 25% and 100% of their participated balances for these additional anticipated losses.

Case #4—A student lending CUSO sold participations of purchased student loans to six FICUs. Related loan losses at these FICUs are much higher than anticipated. One FICU has booked over $4 million in loan losses and projects an additional $4.5 million in losses on the portfolio.

Case #5—A CUSO underwrites and services member business loans for several FICUs. The CUSO's past performance was substandard and a large portion of the serviced loan portfolio was owned by one FCU. The FCU could not recover from the impact of the CUSO's poor lending practices, and the associated loan losses played a role in the FCU's need to merge with a healthier credit union.

Ensign FCU

Involvement in a business loan CUSO was a contributing factor to the failure of Ensign FCU, which has cost the NCUSIF approximately $38 million to date. The CUSO failed to service a member business loan portfolio according to its agreement with the credit union. In November 2010, NCUA filed a suit against the CUSO claiming the CUSO continued to collect payments on 18 commercial loans allegedly owned by Ensign FCU after the credit union was shut down in November 2009. In addition to Ensign FCU, the CUSO worked with three other credit unions. The CUSO has since dissolved.

Eastern New York FCU

Relationships with a complex network of CUSOs, a lack of board of directors' oversight of related business ventures, and improper accounting contributed to the failure of Eastern New York FCU. Several CUSOs were created to generate income, but most of the CUSOs had very few customers. NCUA's Office of the Inspector General determined that the FCU's board of directors did not perform the necessary due diligence to ensure each CUSO was complying with all regulations. NCUA estimates the purchase and assumption of this $50 million credit union will cost the NCUSIF approximately $3.3 million.

Community One FCU

The failure of Community One FCU was due in part to losses stemming from a CUSO involved in indirect auto lending. The credit union's management engaged in an extremely large indirect lending program without adequate policies and collection procedures in place. NCUA estimates the purchase and assumption of this $159 million credit union will cost the NCUSIF approximately $6.8 million.

Kern Central Credit Union

Kern Central CU's failure was due in part to an indirect auto loan program CUSO. The credit union's losses from a concentration of indirect auto loans with high loan-to-value ratios, as well as poor management of the program, contributed to its demise. NCUA estimates the purchase and assumption of this $34 million credit union will cost the NCUSIF approximately $5.6 million.

The above examples clearly demonstrate the material risks that CUSO operations pose to the credit union industry. Moreover, the Board feels a proactive—rather than reactive—approach is necessary to prevent higher potential losses to the NCUSIF in the future. NCUA's methods of managing risk to the NCUSIF must keep pace as credit union and CUSO operations expand and present more risk to the NCUSIF.

As noted above, in 2008, the Board amended the CUSO rule to, among other things, require all FICUs to enter into agreements with CUSOs stating that the CUSOs would provide NCUA and the applicable SSA with “complete access to any books and records of the CUSO and the ability to review CUSO internal controls.” ^[17] In general, this access may involve an onsite CUSO review to determine the degree of risk the CUSO poses to credit unions and the NCUSIF. During such review, an examiner assesses the financial condition of the CUSO and the adequacy of controls; verifies the accuracy of the financial statements; determines the viability of operations and service to member credit unions; and confirms compliance with applicable laws and regulations. NCUA may request a CUSO review if there are safety and soundness concerns to credit unions or if the CUSO poses an undue risk to the NCUSIF. For example, the agency may request a review if a credit union examination raises concerns that the CUSO's operation is adversely affecting the financial condition and operation of the credit union, or if the CUSO has a significant effect on the operations of a credit union or group of credit unions that depend on its services.

While NCUA currently has the authority to access CUSO books and records and to review CUSO internal controls, the agency does not routinely engage in onsite monitoring of CUSOs. The Board believes it is more efficient and more cost-effective for the agency and the credit union system to require CUSOs to submit information about their financial condition directly to NCUA, than for the agency to collect this information indirectly through credit unions or through more widespread onsite CUSO reviews. As noted above, NCUA's current practice is to conduct an onsite CUSO review only if safety and soundness concerns to credit unions exist or if the CUSO poses an undue risk to the NCUSIF. The Board believes the final rule will improve the agency's ability to conduct offsite monitoring of CUSOs and identify emerging areas of concern.

Nevertheless, the Board recognizes that the rule could be more narrowly focused and still achieve the agency's objective of obtaining more complete and accurate information about CUSOs, the services they offer, and their financial condition. Accordingly, the Board is significantly revising the reporting requirement in the final rule.

The majority of commenters suggested NCUA should take a more targeted regulatory approach by tailoring the final rule to identified problem areas. Further, they argued that the proposal's one-size-fits-all approach was misguided. Numerous commenters contended that the rule should be exclusively targeted at CUSOs engaging in riskier activities, such as business lending. CUSOs involved in activities with less risk, such as marketing or licensing CUSOs, should not be subject to increased oversight. Commenters recommended that, at a minimum, certain types of lower-risk CUSOs should be exempted from the rule.

In light of the comments received on the proposed rule, the Board has determined to significantly reduce the scope and application of the reporting requirement in the final rule. Accordingly, the final rule narrowly focuses on CUSOs engaging in certain complex or high-risk activities. The Board notes that the types of activities qualifying as “complex or high-risk,” as well as the reporting requirements for CUSOs engaging in such activities, may evolve as new risks emerge. At this time, however, the Board believes that, for purposes of the reporting requirement, complex or high-risk activities include credit and lending, information technology, and custody, safekeeping, and investment management services for credit unions because these particular activities tend to affect a large number of credit unions and present a high degree of operational and/or financial risk. Activities related to these categories currently include:

• Credit and lending—

○ Business loan origination;

○ Consumer mortgage loan origination;

○ Loan support services, including servicing;

○ Student loan origination; and

○ Credit card loan origination.

• Information technology—

○ Electronic transaction services;

○ Record retention, security, and disaster recovery services; and

○ Payroll processing services.

• Custody, safekeeping, and investment management services for credit unions.^[18]

Credit and lending-related activities involve credit unions' core business function and represent a high degree of potential risk. CUSOs engaging in credit and lending services have the potential to pose multiple types of risks to FICUs and the NCUSIF. Without proper monitoring and controls, FICUs making loans to, and investments in, CUSOs engaged in credit and lending activities may quickly be exposed to significant levels of credit, strategic, or reputation risks. For example, credit risk increases with poor underwriting, which may lead to decreased net worth and increased strategic and reputation risks, all of which can ultimately impact member services. Due to the higher-risk nature of credit and lending activities, the Board believes it is necessary to receive additional information about CUSOs involved in credit and lending activities in order to monitor for material levels of risk to the NCUSIF.

Information technology-related CUSOs usually engage in activities that involve emerging complex electronic services. These services have been subject to malicious attacks, which pose transactional, reputational, and strategic risks to credit unions, and ultimately, the NCUSIF, if proper safeguards are not in place. Moreover, credit union members have been adversely impacted by breaches in network security. The additional data collected for CUSOs engaging in IT services will enable NCUA to better monitor and respond to these increased risks.

In addition, the Board believes CUSOs engaging in custody, safekeeping, and investment management services for credit unions require robust monitoring due to the complex nature of these services. Credit unions place a high degree of reliance on these CUSOs because credit unions are entrusting their assets and their members' assets to CUSOs. As a result, there are increased reputational, strategic, and compliance risks that warrant additional monitoring by NCUA.

Under the final rule, only CUSOs engaging in these complex or high-risk activities are required to report substantive information. All other CUSOs will register only basic profile information. Specifically, the final rule requires a FICU to obtain a written agreement from a CUSO before investing in or lending to the CUSO. This written agreement must provide that the CUSO will annually submit, pursuant to NCUA guidance, a report containing general registration information directly to NCUA and the appropriate SSA, if applicable. This basic registration information will consist of general profile information, including the CUSO's legal name; tax identification number (e.g., EIN); address; telephone number; Web site; primary point of contact; services offered; name(s) and charter(s) of credit union(s) investing in, lending to, or receiving services from the CUSO; and investor(s) and/or subsidiary CUSO(s). The Board believes this is the minimal amount of information necessary to meet the agency's objective of obtaining a clearer and more transparent representation of the CUSO industry.

Only CUSOs involved in complex or high-risk activities will be subject to an additional, enhanced reporting requirement. Specifically, in addition to the basic profile information described above, CUSOs engaged in certain complex or high-risk activities will be required to report more detailed information, including audited financial statements and more specific customer information. The Board believes this additional information is crucial in order for the agency to effectively analyze and monitor the risks CUSOs present to FICUs and the NCUSIF. Specifically, CUSOs engaging in complex or high-risk activities will be required to report:

• For each credit union investing in, lending to, or receiving services from the CUSO:

○ Services provided to each credit union;

○ The investment amount, loan amount, or level of activity of each credit union; and

• The CUSO's most recent year-end audited financial statements.

In addition, CUSOs engaging in credit and lending services will be required to report the following activity by loan type:

• The total dollar amount of loans outstanding;
• The total number of loans outstanding;
• The total dollar amount of loans granted year-to-date; and
• The total number of loans granted year-to-date.

CUSOs that previously were not involved in complex or high-risk activities that become involved in such activities by virtue of: (1) A merger with or acquisition of a CUSO that engages in such activities; or (2) adding new products or services that are complex or high-risk activities will be subject to the enhanced reporting requirement. For example, if a CUSO providing real estate brokerage services merges into a CUSO involved in consumer mortgage loan origination, then the continuing CUSO will be required to submit the additional, enhanced report in the next reporting cycle. Moreover, if a CUSO engaging in checking and currency services begins to offer payroll processing services, then it too will become subject to the enhanced reporting requirement.

Some commenters objected that the actual reporting form required under the proposal would be issued as guidance, without the opportunity for public comment. The Board believes it would be advantageous for FICUs and CUSOs to have the opportunity to review the format and content of the draft reporting form, so all affected parties are adequately prepared to comply with the new requirements once the reporting system is fully established. Accordingly, the draft reporting form is being published in conjunction with this rulemaking. The draft form illustrates the intended reporting format for the basic registration for all CUSOs, as well as the expanded reporting requirement for CUSOs involved in complex or high-risk services. The Board emphasizes that the draft reporting form is subject to change as the agency works to develop and implement the new reporting system for CUSOs. Furthermore, future modifications may be made to the reporting form based on NCUA's assessment of current needs. NCUA intends to submit a copy of the reporting form to the Office of Management and Budget (OMB), as required by the Paperwork Reduction Act (PRA). Accordingly, the public will be provided an opportunity to comment on the form's paperwork requirements. The draft reporting form is found in Section IV of this SUPPLEMENTARY INFORMATION.

Many commenters raised concerns that the proposed reporting requirement could potentially expose CUSOs' confidential business information and trade secrets to public dissemination through Freedom of Information Act (FOIA) requests, putting them at a competitive disadvantage to their non-CUSO counterparts. The Board is sensitive to these concerns. It notes that the FOIA, as well as the applicable exemptions set forth in NCUA's implementing FOIA regulations, applies to any data or information submitted by CUSOs to NCUA under § 712.3(d)(4). The Board anticipates that CUSO submissions will contain or consist of “trade secrets and commercial or financial information obtained from a person and privileged or confidential.” This type of information is subject to withholding under exemption 4 of the FOIA.^[19] In addition, information that is “contained in or related to examination, operating, or condition reports prepared by, on behalf of, or for the use of an agency responsible for the regulation or supervision of financial institutions” is subject to withholding under exemption 8 of the FOIA.^[20] To the extent, however, that CUSO submissions may contain or consist of data or information not subject to an applicable FOIA exemption, for example, a CUSO's name, address, or other publicly available information, that data or information would be releasable under the FOIA.

Several commenters noted that the proposal required the financial report to be submitted “at least” annually. These commenters urged NCUA to clearly define the reporting frequency as “annual.” The Board agrees that reporting under the new rule should occur on an annual basis. As such, the final rule modifies the requirement by establishing the reporting frequency as “annually.” Additionally, the final rule modifies the proposed requirement that a newly formed CUSO file a report within 30 days after its formation. Under the final rule, all newly formed CUSOs will be required to file a report within 60 days of formation. For newly formed CUSOs involved in complex or high-risk activities, such report must include the enhanced information; all other newly formed CUSOs will report only basic registration information. For purposes of this requirement, the definition of “newly formed CUSO” includes a newly established business or an established business that becomes subject to this regulation by virtue of a credit union's investment or loan to the business. Again, NCUA will publish guidance on the report, providing more specific information on the correct format, timing, and required information.

Commenters also raised concerns that the proposal is unclear about how the information reported directly by CUSOs will be used by the agency. Numerous commenters noted that, by design, CUSOs generally do not have a sizable capital structure or generate significant income. These commenters urged NCUA not to evaluate CUSOs based solely on their balance sheets and income statements.

The Board is mindful of commenters' concerns and emphasizes that the agency appreciates the value that CUSOs bring to the credit union industry as collaborative tools for credit unions to achieve economies of scale, retain expertise, and better serve their members. The Board recognizes that CUSOs, in their supportive function, are intentionally designed to operate on thin margins in order to realize greater benefits to credit unions. Accordingly, the Board understands that balance sheets and income statements alone do not reflect the true value of CUSOs. The Board continues to believe, however, that the ability to accurately inventory CUSOs and evaluate their financial and operational condition is paramount to mitigating risk to the credit union system as a whole. It emphasizes that NCUA intends to use the information reported by CUSOs to inform the agency's supervisory oversight of FICUs. For example, NCUA may use the information to help credit unions improve their due diligence, to raise examiner awareness of identified risks, and to foster collaborative problem-solving among CUSOs, credit unions, SSAs, and NCUA. The Board feels that the final rule achieves the balance of exercising regulatory restraint while ensuring the ultimate safety and soundness of the NCUSIF.

Subsidiary CUSOs—§ 712.11

The proposed rule added a new section to the CUSO regulation, applicable to both FCUs and FISCUs, prohibiting a FICU from investing in a CUSO unless all subsidiaries of the CUSO also agree to follow all applicable laws and regulations. (Proposed § 712.11).

A significant number of commenters expressed concern that the proposal would treat any entity in which a CUSO invests as a subsidiary subject to the CUSO regulation. They argued that non-controlling investments should not trigger the regulation. Several commenters suggested that the informal rule has been that a CUSO subsidiary is impermissible if the subsidiary was formed with the intent and purpose of evading the CUSO rule, and they recommended that the Board adopt this standard in the final rule.

The Board disagrees and adopts the subsidiary provision substantially as proposed. NCUA's policy with regard to CUSO subsidiaries has been publicly stated since at least 1997, although it has never been included in regulatory text. Specifically, under existing policy, the CUSO rule applies to all levels or tiers of a CUSO's structure. Any subsidiary entity in which a CUSO invests will also be treated as a CUSO and, thus, subject to the regulation.^[21] The Board continues to believe there is an inherent risk that a subsidiary CUSO could adversely affect the investing credit union and, ultimately, the NCUSIF. Accordingly, the final rule clarifies the regulation's applicability to subsidiary CUSOs by codifying NCUA's existing policy in the regulatory text. The Board believes it is appropriate to codify this requirement in the regulation to ensure that credit unions and CUSOs are aware that the requirements of the CUSO rule and applicable state rules apply to all subsidiary entities in which a CUSO invests, including those entities with the appearance of being formed with the intent and purpose of evading the CUSO rule. This requirement will apply to any entity in which a CUSO has an ownership interest of any amount, if that entity is engaged primarily in providing products or services to credit unions or credit union members. The provision, however, will not apply to third parties with whom a CUSO contracts or otherwise does business. Because this provision (§ 712.11) applies to all FICUs, the definition of a CUSO in § 741.222 is also amended to include subsidiary entities in which a CUSO invests any amount, if that entity is engaged primarily in providing products or services to credit unions or members.

Definitions and Conforming Amendments

The Board is making several technical and conforming amendments. The final rule updates § 712.1 to make certain technical changes, to reflect the amendments in this rulemaking, and to add a definition to provide that the term “federally insured credit union” or “FICU” means all FCUs and FISCUs. In addition, the final rule brings the language contained in § 741.222 that defines the term “CUSO” into § 712.1 as well. The Board believes that parallel references to “CUSO” in both § 712.1 and § 742.222 will add clarity and consistency to the regulations addressing CUSOs. Additionally, § 712.1 and § 741.222 are being revised to conform with § 701.30, which was amended to include remittance transfers.^[22] Finally, technical changes are made in § 712.4(b) to clarify that written legal advice is required prior to a FICU investing in a CUSO.

State Exemptions

Section 712.10 of the current rule allows SSAs to apply for an exemption, on behalf of FISCUs, from § 712.3(d)(3), the provision addressing access to books and records with which FISCUs must comply. Because the proposed rule added additional requirements for FISCUs (proposed § 712.3(d)(1) and (2)), the proposal expanded § 712.10 to allow SSAs to obtain an exemption, on behalf of FISCUs, from compliance with these additional provisions. The proposed changes did not alter the manner in which an SSA can obtain an exemption, but merely made changes that take into account that some states may already have equivalent or more stringent rules or requirements that govern financial reporting, audits, and accounting practices of FISCUs and their CUSOs. The proposed rule, however, did not allow for an SSA to apply for an exemption, on behalf of FISCUs, from the new reporting requirement in proposed § 712.3(d)(4) because allowing an exemption from this requirement would result in inconsistent reporting based on the varying laws in the different states. Commenters were either generally supportive of, or did not provide comment on, these particular changes. Accordingly, the Board adopts the amendments to § 712.10 substantially as proposed. The final rule clarifies, however, that NCUA may grant state exemptions from any or all of § 712.3(d)(1), (2), and (3) only if state law is equal to, or more stringent than, NCUA's requirements.

Transition Period for Compliance

The Board recognizes that FICUs with loans to or investments in CUSOs will be required under this final rule to make changes in the agreements they currently have with their CUSOs. Accordingly, the effective date of the final rule is June 30, 2014. Additionally, CUSOs will begin submitting reports to NCUA under new § 712.3(d)(4) when the agency's reporting system is fully operational, which will be by December 31, 2015.

IV. Draft Reporting Form

The Board is publishing a draft reporting form to illustrate the intended format for CUSO reports submitted under § 712.3(d)(4) of this final rule. The draft shows the planned reporting format for the basic registration for all CUSOs, as well as the expanded reporting requirement for CUSOs engaging in complex or high-risk activities. The Board notes, however, that the draft reporting form is subject to change as the agency develops and implements the new reporting system for CUSOs. Further, once finalized, the agency may later modify the reporting form based on NCUA's assessment of changing industry needs. In accordance with the requirements of the PRA, NCUA will submit a copy of the reporting form to the OMB, along with an application for an OMB Control Number. At that time, the public will be provided an opportunity to comment on the form's paperwork requirements, including NCUA's estimate of the burden of the paperwork requirements.

V. Regulatory Procedures

Regulatory Flexibility Act

The Regulatory Flexibility Act (RFA) requires NCUA to prepare an analysis to describe any significant economic impact a regulation may have on a substantial number of small entities. NCUA considers credit unions having less than fifty million dollars in assets to be small for purposes of RFA.^[23] The changes to the CUSO rule impose minimal compliance obligations by requiring FISCUs to comply with certain regulatory requirements concerning agreements with CUSOs and certain recapitalization limits. NCUA has determined and certifies that the final rule will not have a significant economic impact on a substantial number of small credit unions.

Paperwork Reduction Act

The PRA applies to rulemakings in which an agency by rule creates a new paperwork burden on regulated entities or modifies an existing burden.^[24] For purposes of the PRA, a paperwork burden may take the form of either a reporting or a recordkeeping requirement, both referred to as information collections. NCUA recognizes that this final rule requires FISCUs and FCUs to comply with certain requirements that constitute an information collection within the meaning of the PRA. Under this rule, FISCUs with an investment in or loan to a CUSO will need to revise the current agreement they have with their CUSO to provide that the CUSO will account for all its transactions in accordance with GAAP, prepare quarterly financial statements and obtain an annual financial statement audit of its financial statements by a licensed certified public accountant. The rule also requires FISCUs, in certain circumstances, to submit an application for regulatory approval to recapitalize an insolvent CUSO. Additionally, the final rule requires FICUs to enter into agreements with CUSOs requiring CUSOs to submit reports directly to NCUA and the appropriate SSA.

Currently, NCUA cannot fully determine the total number of CUSOs that presently exist, which CUSOs maintain relationships with which credit unions, the financial condition of CUSOs, or the full range of services offered by CUSOs. The current information is incomplete, primarily because the agency is collecting information from the CUSOs' credit union clients rather than directly from each CUSO itself. Nevertheless, according to NCUA records, of the 2,492 FISCUs that filed a Form 5300 Call Report with NCUA as of June 30, 2013, 1,161 reported an interest in at least one CUSO, and a total of 2,836 CUSO interests was reported. For purposes of this analysis, NCUA estimates that this requirement will affect all FISCUs reporting an interest in a CUSO. Using these estimates, information collection obligations imposed by this aspect of the rule, on an annual basis, are analyzed below:

Changing the written agreement relating to certain accounting and reporting requirements.

FISCUs with a reported interest in a CUSO as of 6/30/2013: 1,161.

Frequency of response: one-time ^[25]

Initial hour burden: 4.

4 hour × 1,161 = 4,644

In addition to the requirement for FISCUs to revise their agreements with CUSOs, this rule also requires FCUs with an investment in or loan to a CUSO to revise the current agreement they have with their CUSO to provide that the CUSO submit a financial report directly to NCUA. According to NCUA records, of the 4,189 FCUs that filed a form 5300 call report with NCUA as of June 30, 2013, 1,413 reported at least one interest in a CUSO; a total of 3,275 CUSO interests was reported. For purposes of this analysis, NCUA estimates that this requirement will affect all FCUs with a reported interest in a CUSO. Using these estimates, information collection obligations imposed by this aspect of the rule, on an annual basis, are analyzed below:

Changing the written agreement relating to reports to NCUA.

FCUs with a reported interest in a CUSO as of 6/30/2013: 1,413.

Frequency of response: one-time.

Initial hour burden: 4.

4 hour × 1,413 = 5,652

Initial CUSO reporting to NCUA—basic information.

Reported CUSOs as of 6/30/2013 ^[26] : 1,197.

Frequency of response: one-time.

Initial hour burden: 0.5.

0.5 × 1,197 = 598.5

Initial CUSO reporting to NCUA—expanded information.

Reported CUSOs providing credit and lending, IT, or custody, safekeeping, and investment management services for credit unions as of 6/30/2013: ^[27] 600.

Frequency of response: one-time.

Initial hour burden: 3.

3 hours × 600 = 1,800

Annual CUSO reporting to NCUA—expanded information.

Reported CUSOs providing credit and lending, IT, or custody, safekeeping, and investment management services for credit unions services as of 6/30/2013: 600.

Frequency of response: Annual.

Initial hour burden: 3.

3 hour × 600 = 1,800

Direct reporting by CUSOs, however, will lessen the existing burden to FICUs for reporting their CUSO interests to NCUA. According to NCUA records, of the 6,681 FICUs that filed a form 5300 call report with NCUA as of June 30, 2013, 2,574 reported at least one interest in a CUSO.

For purposes of this analysis, NCUA estimates that this requirement will affect all FICUs with a reported interest in a CUSO. Using these estimates, the reduced burden to FICUs by this aspect of the rule, on an annual basis, is analyzed below:

Completing the CUSO section of 5300 call report.

FICUs with a reported interest in a CUSO as of 6/30/2013: 2,574.

Frequency of response: Quarterly.

Reduced hour burden: 0.4.

0.4 hours × 2,574 × 4 = 4,118.4

Completing the CUSO section of CU Online profile.

FICUs with a reported interest in a CUSO as of 6/30/2013: 2,574.

Frequency of response: Semi-annually.

Reduced hour burden: 0.2.

0.2 hours × 2,574 × 2 = 1,029.6

Another aspect of this final rule that involves PRA consideration is the requirement pertaining to recapitalizing CUSOs that have become insolvent. The final rule will require certain FISCUs to seek and obtain prior approval from their SSA before making an investment to recapitalize an insolvent CUSO. According to NCUA's records, as of June 30, 2013, there were only 17 FISCUs that were less than adequately capitalized (i.e., net worth of under 6%). Of these FISCUs, 9 currently have an interest in a CUSO. NCUA estimates it would take a FISCU approximately two hours to complete a request for the SSA's prior approval for an investment to recapitalize an insolvent CUSO.

Obtaining regulatory approval:

Total less than adequately capitalized FISCUs with an interest in a CUSO as of 6/30/2013: 9.

Frequency of response: one-time.

Initial hour burden: 2.

2 hours × 9 = 18

In accordance with the requirements of the PRA, NCUA intends to obtain a modification of its OMB Control Number, 3133-0149, to support these changes. Simultaneously with its publication of this final rule, NCUA is submitting a copy of the final rule to OMB, along with an application for a modification of the OMB Control Number.

The PRA and OMB regulations require that the public be provided an opportunity to comment on the paperwork requirements, including an agency's estimate of the burden of the paperwork requirements. The Board invites comment on: (1) Whether the paperwork requirements are necessary; (2) the accuracy of NCUA's estimates on the burden of the paperwork requirements; (3) ways to enhance the quality, utility, and clarity of the paperwork requirements; and (4) ways to minimize the burden of the paperwork requirements.

Comments should be sent to the NCUA Contact and the OMB Reviewer listed below:

NCUA Contact: Tracy Crews, National Credit Union Administration, 1775 Duke Street, Alexandria, Virginia 22314-3428, Fax No. 703-837-2861, Email: [e-mail]

OMB Contact: Office of Management and Budget, ATTN: Desk Officer for the National Credit Union Administration, Office of Information and Regulatory Affairs, Washington, DC 20503

Executive Order 13132

Executive Order 13132 encourages independent regulatory agencies to consider the impact of their actions on state and local interests. In adherence to fundamental federalism principles, NCUA, an independent regulatory agency,^[28] voluntarily complies with the Executive Order.

The major aspects of the rule make certain aspects applicable to FISCUs. By law, these institutions are already subject to numerous provisions of NCUA's rules, based on the agency's role as the insurer of member share accounts and the significant interest NCUA has in the safety and soundness of their operations. In developing the rule, NCUA worked with representatives of the state credit union regulatory community. This rule incorporates a mechanism by which states may request an exemption from coverage of part of the rule for institutions in that state, provided certain criteria are met. In any event, the final rule will not have substantial direct effects on the states, on the relationship between the national government and the states, or on the distribution of power and responsibilities among the various levels of government. NCUA has determined that this final rule does not constitute a policy that has federalism implications for purposes of the executive order.

Assessment of Federal Regulations and Policies on Families

NCUA has determined that this final rule will not affect family well-being within the meaning of Section 654 of the Treasury and General Government Appropriations Act, 1999.^[29]

Small Business Regulatory Enforcement Fairness Act

The Small Business Regulatory Enforcement Fairness Act of 1996 ^[30] (SBREFA) provides generally for congressional review of agency rules. A reporting requirement is triggered in instances where NCUA issues a final rule as defined by Section 551 of the Administrative Procedure Act.^[31] NCUA does not believe this final rule is a “major rule” within the meaning of the relevant sections of SBREFA. NCUA has submitted the rule to OMB for its determination in that regard.

List of Subjects

12 CFR Part 712

• Administrative practices and procedure, credit, credit unions, insurance, investments, reporting, and record keeping requirements

12 CFR Part 741

• Credit
• Credit unions
• Reporting and recordkeeping requirements
• Share insurance

By the National Credit Union Administration Board on November 21, 2013.

Gerard Poliquin,

Secretary of the Board.

Accordingly, NCUA amends 12 CFR Parts 712 and 741 as follows:

PART 712—CREDIT UNION SERVICE ORGANIZATIONS (CUSOS)

1. The authority citation for part 712 continues to read as follows:

Authority: 12 U.S.C. 1756, 1757(5)(D), and (7)(I), 1766, 1781(b)(9), 1782, 1784, 1785, 1786 and 1789(11).

2. Revise § 712.1 to read as follows:

§ 712.1

What does this part cover?

(a) This part establishes when a federal credit union (FCU) can invest in and make loans to credit union service organizations (CUSOs). CUSOs are subject to review by NCUA. This part does not apply to corporate credit unions that have CUSOs subject to § 704.11 of this chapter.

(b) All sections of this part apply to FCUs. Sections 712.2(d)(2)(ii), 712.3(d), 712.4 and 712.11(b) and (c) of this part apply to federally insured, state-chartered credit unions (FISCUs), as provided in § 741.222 of this chapter. FISCUs must follow the law in the state in which they are chartered with respect to the sections in this part that only apply to FCUs.

(c) As used in this part, federally insured credit union (FICU) means an FCU or FISCU.

(d) As used in this part, CUSO means any entity in which a FICU has an ownership interest or to which a FICU has extended a loan, and that entity is engaged primarily in providing products or services to credit unions or credit union members, or, in the case of checking and currency services, including cashing checks and money orders for a fee, and selling negotiable checks, including travelers checks, money orders, and other similar money transfer instruments (including international and domestic electronic fund transfers and remittance transfers, as defined in section 919 of the Electronic Fund Transfer Act, 15 U.S.C. 1693o-1), to persons eligible for membership in any credit union having a loan, investment or contract with the entity. A CUSO also includes any entity in which a CUSO has an ownership interest of any amount, if that entity is engaged primarily in providing products or services to credit unions or credit union members.

3. Revise § 712.2(d)(2) to read as follows:

§ 712.2

How much can an FCU invest in or loan to CUSOs, and what parties may participate?

* * * * *

(d) * * *

(2) Special rule in the case of less than adequately capitalized FICUs. This rule applies in the case of a FICU that is currently less than adequately capitalized, as determined under part 702 of this chapter, or where the making of an investment in a CUSO would render the FICU less than adequately capitalized under part 702 of this chapter. Before making an investment in a CUSO:

(i) A less than adequately capitalized FCU, or an FCU that would be rendered less than adequately capitalized by the recapitalization of a CUSO, must obtain prior written approval from the appropriate NCUA regional office if the making of the investment would result in an aggregate cash outlay, measured on a cumulative basis (regardless of how the investment is valued for accounting purposes, but limited to the immediately preceding seven (7) years) in an amount that is in excess of 1% of its paid-in and unimpaired capital and surplus; or

(ii) A less than adequately capitalized FISCU, or a FISCU that would be rendered less than adequately capitalized by the recapitalization of a CUSO, must obtain prior written approval from the appropriate state supervisory authority if the making of the investment would result in an aggregate cash outlay, measured on a cumulative basis (regardless of how the investment is valued for accounting purposes, but limited to the immediately preceding seven (7) years) in an amount that is in excess of the investment limit in the state in which it is chartered. A FISCU must also contemporaneously submit a copy of this request to the appropriate NCUA regional office. If there is no state limit in the state in which a FISCU is chartered, the requirements in paragraph (d)(2)(i) of this section will apply to that FISCU.

* * * * *

4. Revise § 712.3(d) to read as follows:

712.3

What are the characteristics of and what requirements apply to CUSOs?

* * * * *

(d) CUSO accounting; audits and financial statements; NCUA access to information. A FICU must obtain a written agreement from a CUSO before investing in or lending to the CUSO that the CUSO will:

(1) Account for all of its transactions in accordance with GAAP;

(2) Prepare quarterly financial statements and obtain an annual financial statement audit of its financial statements by a licensed certified public accountant in accordance with generally accepted auditing standards. A wholly owned CUSO is not required to obtain a separate annual financial statement audit if that wholly owned CUSO is included in the annual consolidated financial statement audit of the investing FICU;

(3) Provide NCUA, its representatives, and the state supervisory authority having jurisdiction over any FISCU with an outstanding loan to, investment in or contractual agreement for products or services with the CUSO with complete access to any books and records of the CUSO and the ability to review the CUSO's internal controls, as deemed necessary by NCUA or the state supervisory authority in carrying out their respective responsibilities under the Act and the relevant state credit union statute;

(4) Annually submit, pursuant to NCUA guidance, a report directly to NCUA and the appropriate state supervisory authority, if applicable. A newly formed CUSO (including a pre-existing business which becomes subject to this regulation by virtue of a credit union investment or loan) must file a report within 60 days of its formation. The report must contain basic registration information, including the CUSO's legal name; tax identification number; address; telephone number; Web site; primary point of contact; services offered; the name(s) and charter(s) of credit union(s) investing in, lending to, or receiving services from the CUSO; and investor and/or subsidiary CUSO(s). In addition, for any CUSO engaged in complex or high-risk activities, the report must contain:

(i) For each credit union investing in, lending to, or receiving services from the CUSO:

(A) A list of services provided to each credit union;

(B) The investment amount, loan amount, or level of activity of each credit union;

(ii) The CUSO's most recent year-end audited financial statements; and

(iii) (A) For CUSOs engaged in credit and lending services:

(1) The total dollar amount of loans outstanding;

(2) The total number of loans outstanding;

(3) The total dollar amount of loans granted year-to-date; and

(4) The total number of loans granted year-to-date.

(B) Such information must be provided by loan type for each type of loan originated or serviced by the CUSO.

(5) For purposes of paragraph (d)(4) of this section, complex or high-risk activities include preapproved CUSO activities and services related to credit and lending, information technology, and custody, safekeeping, and investment management services for credit unions. Specific activities related to these categories include:

(i) Credit and lending:

(A) Business loan origination;

(B) Consumer mortgage loan origination;

(C) Loan support services, including servicing;

(D) Student loan origination; and

(E) Credit card loan origination.

(ii) Information technology:

(A) Electronic transaction services;

(B) Record retention, security, and disaster recovery services; and

(C) Payroll processing services.

(iii) Custody, safekeeping, and investment management services for credit unions.

* * * * *

5. Revise § 712.4 to read as follows:

§ 712.4

What must a FICU and a CUSO do to maintain separate corporate identities?

(a) Corporate separateness. A FICU and a CUSO must be operated in a manner that demonstrates to the public the separate corporate existence of the FICU and the CUSO. Good business practices dictate that each must operate so that:

(1) Its respective business transactions, accounts, and records are not intermingled;

(2) Each observes the formalities of its separate corporate procedures;

(3) Each is adequately financed as a separate unit in the light of normal obligations reasonably foreseeable in a business of its size and character;

(4) Each is held out to the public as a separate enterprise;

(5) The FICU does not dominate the CUSO to the extent that the CUSO is treated as a department of the FICU; and

(6) Unless the FICU has guaranteed a loan obtained by the CUSO, all borrowings by the CUSO indicate that the FICU is not liable.

(b) Written legal advice. Prior to a FICU investing in a CUSO, the FICU must obtain written legal advice as to whether the CUSO is established in a manner that will limit potential exposure of the FICU to no more than the loss of funds invested in, or loaned to, the CUSO. In addition, if a FICU invests in, or makes a loan to, a CUSO, and that CUSO plans to change its structure under § 712.3(a), the FICU must also obtain prior written legal advice that the CUSO will remain established in a manner that will limit potential exposure of the FICU to no more than the loss of funds invested in, or loaned to, the CUSO. The written legal advice must address factors that have led courts to “pierce the corporate veil,” such as inadequate capitalization, lack of separate corporate identity, common boards of directors and employees, control of one entity over another, and lack of separate books and records. The written legal advice must be provided by independent legal counsel of the investing FICU or the CUSO.

§ 712.9

[Removed and Reserved]

6. Remove and reserve § 712.9.

7. Revise § 712.10 to read as follows:

§ 712.10

How can a state supervisory authority obtain an exemption for FISCUs from compliance with § 712.3(d)(1), (2), and (3)?

(a) The NCUA Board may exempt FISCUs in a given state from compliance with any or all of § 712.3(d)(1), (2), and (3) if the NCUA Board determines the laws in that state are equal to, or more stringent than, § 712.3(d)(1), (2), and (3), and the laws and procedures available to the supervisory authority in that state are sufficient to provide NCUA with the degree of access and information it believes is necessary to evaluate the safety and soundness of FICUs having business relationships with CUSOs owned by FISCUs in that state.

(b) To obtain an exemption, the state supervisory authority must submit a copy of the legal authority pursuant to which it secures the information required in § 712.3(d)(1), (2), and (3) of this part to NCUA's regional office having responsibility for that state, along with all procedural and operational documentation supporting and describing the actual practices by which it implements and exercises the authority.

(c) The state supervisory authority must provide the regional director with an assurance that NCUA examiners will be provided with co-extensive authority and will be allowed direct access to CUSO books and records at such times as NCUA, in its sole discretion, may determine necessary or appropriate. For purposes of this section, access includes the right to make and retain copies of any CUSO record, as to which NCUA will accord the same level of control and confidentiality that it uses with respect to all other examination-related materials it obtains in the course of its duties.

(d) The state supervisory authority must also provide the regional director with an assurance that NCUA, upon request, will have access to copies of any financial statements or reports which a CUSO has provided to the state supervisory authority.

(e) The regional director will review the applicable authority, procedures and assurances and forward the exemption request, along with the regional director's recommendation, to the NCUA Board for a final determination.

(f) For purposes of this section, whether an entity is a CUSO shall be determined in accordance with the definition set out in § 741.222 of this chapter.

8. Add new § 712.11 to read as follows:

§ 712.11

What requirements apply to subsidiary CUSOs?

(a) FCUs investing in a CUSO with a subsidiary CUSO. FCUs may only invest in or loan to a CUSO, which has a subsidiary CUSO, if the subsidiary CUSO satisfies all of the requirements of this part. The requirements of this part apply to all tiers or levels of a CUSO's structure.

(b) FISCUs investing in a CUSO with a subsidiary CUSO. FISCUs may only invest in or loan to a CUSO which has a subsidiary CUSO, if the subsidiary CUSO complies with the following:

(1) All applicable state laws and rules regarding CUSOs; and

(2) All of the requirements of this part that apply to FISCUs, which are listed in § 712.1. The requirements of this part that apply to FISCUs apply to all tiers or levels of a CUSO's structure.

(c) For purposes of this section, a subsidiary CUSO is any entity in which a CUSO has an ownership interest of any amount, if that entity is engaged primarily in providing products or services to credit unions or credit union members.

PART 741—REQUIREMENTS FOR INSURANCE

9. The authority citation for part 741 continues to read as follows:

Authority: 12 U.S.C. 1757, 1766, 1781-1790, and 1790d.

10. Revise § 741.222 to read as follows:

§ 741.222

Credit union service organizations.

(a) Any credit union that is insured pursuant to Title II of the Act must adhere to the requirements in §§ 712.2(d)(2)(ii), 712.3(d), 712.4 and 712.11(b) and (c) of this chapter concerning permissible investment limits for less than adequately capitalized credit unions, agreements between credit unions and their credit union service organizations (CUSOs), the requirement to maintain separate corporate identities, and investments and loans to CUSOs investing in other CUSOs. For purposes of this section, a CUSO is any entity in which a credit union has an ownership interest or to which a credit union has extended a loan, and that entity is engaged primarily in providing products or services to credit unions or credit union members, or, in the case of checking and currency services, including cashing checks and money orders for a fee, and selling negotiable checks, including travelers checks, money orders, and other similar money transfer instruments (including international and domestic electronic fund transfers and remittance transfers, as defined in section 919 of the Electronic Fund Transfer Act, 15 U.S.C. 1693o-1), to persons eligible for membership in any credit union having a loan, investment or contract with the entity. A CUSO also includes any entity in which a CUSO has an ownership interest of any amount, if that entity is engaged primarily in providing products or services to credit unions or credit union members.

(b) This section shall have no preemptive effect with respect to the laws or rules of any state providing for access to CUSO books and records or CUSO examination by credit union regulatory authorities.

Footnotes

1.  73 FR 79312 (Dec. 29, 2008).

2.  Id.

3.  76 FR 44866 (July 27, 2011).

4.  12 U.S.C. 1766.

5.  12 U.S.C. 1781(b)(9), 1789(11).

6.  12 U.S.C. 1757(5)(D).

7.  12 U.S.C. 1757(7)(I).

8.  See, e.g., N.D. Admin. Code 13-03-23-06 (10% of equity); Ind. Code § 28-7-1-9 (10% of capital, surplus, and unimpaired shares, or higher with prior written approval); Me. Rev. Stat. Ann. tit. 9-B, § 864 (10% of share capital and surplus); Idaho Code Ann. § 26-2146 (10% of paid-in shares and deposits); Mich. Comp. Laws Ann. § 490.401 (12% of assets with prior approval); N.C. Gen. Stat. § 54-109.82 (25% of allocations to the reserve fund); Mont. Code Ann. § 32-3-701 (no limit specified).

9.  73 FR 79312 (Dec. 29, 2008).

10.  73 FR 23982, 23984 (May 1, 2008).

11.  12 CFR part 702.

12.  73 FR 79312 (Dec. 29, 2008).

13.  12 U.S.C. 1757(7)(I), 1757(5)(D).

14.  44 FR 12401 (Mar. 7, 1979).

15.  12 U.S.C. 1781(b)(9), 1789(11).

16.  The agency does not have a formal mechanism to track information about losses attributable to CUSOs. Further, there are different types of losses that can be realized by credit unions, including losses in terms of the investment in or loan to the CUSO and losses incurred from the product or service offered by the CUSO (for example, loan losses). Credit union failures can rarely be attributed to one factor alone. Failures typically arise out of a compounding of poor decisions on the part of credit union management. There are examples, however, of losses in credit unions as a direct result of CUSO activity. In some cases, these losses led to the failure of the institutions involved.

17.  74 FR 79312 (Dec. 29, 2008); 12 CFR 712.3(d)(3)(i).

18.  CUSOs only engaging in trust services for individual credit union members will be required to submit only basic profile information. These CUSOs will not be required to submit the additional, enhanced report.

19.  5 U.S.C. 552(b)(4); 12 CFR 792.11(a)(4).

20.  5 U.S.C. 552(b)(8); 12 CFR 792.11(a)(8) (emphasis added).

21.  62 FR 11781 (Mar. 13, 1997).

22.  76 FR 44761 (July 27, 2011); 76 FR 73993 (Nov. 30, 2011).

23.  Interpretive Ruling and Policy Statement (IRPS) 87-2 as amended by IRPS 03-2, 68 FR 30950 (May 29, 2003) and IRPS 13-1, 78 FR 4032 (Jan. 18, 2013).

24.  44 U.S.C. 3507(d); 5 CFR Part 1320.

25.  One-time estimates account for, on average, approximately two CUSOs per credit union. The actual frequency will vary based on the credit union's actual number of reported interests in a CUSO.

26.  Numbers reported may be over or understated based on the problems with gathering CUSO data from credit unions rather than from CUSOs directly.

27.  Estimates are likely overstated as credit unions currently report only broad categories of services as defined in the regulation. The expanded reporting requirements under this rule are more narrowly defined and will result in fewer CUSOs affected.

28.  44 U.S.C. 3502(5).

29.  Public Law 105-277, 112 Stat. 2681 (1998).

30.  Public Law 104-121, 110 Stat. 857 (1996).

31.  5 U.S.C. 551.